Rush, C. J.
Nearly twenty-five years ago, Justice Dickson recognized a need for “deterrence and accountability” due to “the growing technological opportunities for invasive scrutiny into others’ lives, the compilation of private data, and the disclosure of purely personal matters.” His prescient observation is more relevant today than ever before. Indeed, much of our personal information is stored digitally, and unauthorized access to private data has never been easier. Take medical records—with the click of a button, countless health-care professionals can view our most private, sensitive health information. To be sure, this ready access has revolutionized the industry, allowing medical personnel to diagnose and treat patients quickly and accurately. But with great access comes great responsibility—an abuse of which may give rise to liability.
Here, an employee of a health-care provider improperly accessed and disclosed information from numerous patients’ medical records. Determining whether the provider is liable for that conduct requires us to address several issues: the applicability of Indiana’s Medical Malpractice Act; the proper scope-of-employment inquiry; the availability of emotional-distress damages in negligence-based claims; and the viability of an invasion-of-privacy claim for the public disclosure of private facts.
We conclude that the Medical Malpractice Act does not apply to these circumstances. We then find that there are genuine issues of material fact as to whether the employee’s acts were within the scope of employment. Importantly, we confirm the viability of a tort claim for the public disclosure of private facts. But we ultimately hold that the health-care provider is not liable because the undisputed facts negate a required element on both the negligence claims and the public-disclosure claim.
….
Before analyzing whether Plaintiffs’ claims survive summary judgment, we address a threshold issue: whether Plaintiffs’ claims against Community are subject to the MMA. Community asserts “there is no dispute that Plaintiffs’ claims fall within the scope of the MMA.” Plaintiffs disagree, maintaining the MMA does not apply to “claims alleging the mishandling of a patient’s confidential information.” On this record, we agree with Plaintiffs. The misconduct alleged does not constitute “malpractice,” and thus, the trial court did not err in denying Community’s motion to dismiss for lack of subject-matter jurisdiction.
We then address whether Community is entitled to summary judgment. Plaintiffs seek to hold Community vicariously liable for Gray’s tortious acts—negligence and invasion of privacy—under the doctrine of respondeat superior, and directly liable for negligent training, supervision, and retention. Ultimately, we conclude that Community is entitled to summary judgment because it has negated a required element on each claim. But within our analysis, we clarify the proper scope-of-employment inquiry when vicarious liability is predicated on an employee’s unauthorized acts. Finally, we explicitly recognize the viability of an invasion-of-privacy tort claim based on the public disclosure of private facts. But because Community has negated the tort’s “publicity” element, that claim also fails.
I. The MMA does not apply to Plaintiffs’ claims.
….
Although this case presents a close call, on this record we conclude that Community’s internal business decisions and access protocols for medical records are not professional services provided to a patient. Community acts largely on its own behalf in developing and implementing its policies for safeguarding confidential patient health information. And these policies—which are directed inward to Community employees, not outward to its patients—are used to execute Community’s regulatory obligations and balance its business risks. Simply put, Community’s applicable protocols and procedures are neither conduct related “to the promotion of a patient’s health” nor do they require “the provider’s exercise of professional expertise, skill, or judgment.” Gordon, 952 N.E.2d at 185. Additionally relevant here, Plaintiffs were not patients of any of the orthopedic providers for whom Gray was responsible for scheduling appointments and releasing medical records. Thus, Gray’s unauthorized access of Plaintiffs’ medical records was unrelated to any professional service executed on their behalf as Community’s patients.
To summarize, the alleged misconduct does not fall under the MMA. It lacks a temporal connection to any care provided by Community to the Plaintiffs as patients. And it was also unrelated to either the promotion of a patient’s health or the provider’s exercise of professional expertise, skill, or judgment. We note, however, that while the MMA is inapplicable here, the same may not be true for other claims involving medical records. Take, for example, claims for their improper maintenance. Where shoddy maintenance leaves medical records inaccurate, inaccessible, or missing, providers may not have at their disposal reliable patient information for diagnosing or treating an illness. See id. at 186. In such circumstances, the connection “to a patient” is clear and direct—and so is the MMA’s application. See id. But those circumstances are not before us. And thus, the trial court did not err in denying Community’s motion to dismiss for lack of subject-matter jurisdiction.
II. While questions of fact remain on the scope-of-employment issue, Community has negated an element of each claim
….
Plaintiffs seek to hold Community liable under two theories: negligent training, supervision, and retention and the doctrine of respondeat superior. The first imposes direct liability on Community and requires that Gray’s access and disclosure of Plaintiffs’ medical records was outside the scope of her employment. See Sedam v. 2JR Pizza Enters., LLC, 84 N.E.3d 1174, 1178 (Ind. 2017). The second imposes vicarious liability on Community for Gray’s tortious acts—negligence and invasion of privacy—and requires that the misconduct was within the scope of her employment. See id. So, though these are alternative theories of relief that ultimately seek the same result, the claims under both can survive summary judgment if there is a genuine issue of material fact on the scope-of-employment issue. Whether an act falls within this scope is generally a question of fact. Knighten v. E. Chi. Hous. Auth., 45 N.E.3d 788, 794 (Ind. 2015).
A. An employee’s conduct may fall within the scope of employment even though it is unauthorized and violates an agreed-to policy.
….
To be sure, if an employee engages in unauthorized conduct that is in direct violation of agreed-to policies and procedures—such as a confidentiality agreement—then this evidence weighs heavily toward a finding that the actions were outside the scope of employment. See, e.g., Robbins v. Trs. of Ind. Univ., 45 N.E.3d 1, 11 (Ind. Ct. App. 2015). But also relevant is evidence demonstrating that the employee’s actions naturally or predictably arose from delegated employment activities within the employer’s control. See, e.g., SoderVick v. Parkview Health Sys., Inc. 148 N.E.3d 1124, 1132 (Ind. Ct. App. 2020). With these considerations in mind, we determine if the record leads to a conclusion that Gray’s actions fell outside the scope of her employment as a matter of law.
B. There are genuine issues of material fact on the scope-of-employment issue.
The designated evidence raises questions of fact as to whether Gray’s unauthorized access of Plaintiffs’ medical records arose naturally or predictably from her unrestricted access to the records of all Community patients. We reach this conclusion based on a combination of factors: Community’s complete control over Gray’s access to patient records; Gray’s lack of understanding regarding the scope of that access; and Community’s failure to identify the misconduct.
….
C. Community is entitled to summary judgment on both negligence-based claims because the undisputed facts negate the damages element.
….
… But the undisputed facts establish that Plaintiffs did not perceive any physical injury to a loved one. Thus, because emotional-distress damages are unavailable to Plaintiffs, both negligence claims fail. [Footnote omitted.]
Community is therefore entitled to summary judgment on the claim for vicarious liability based on Gray’s alleged negligence and on the claim for negligent hiring, retention, and supervision. We now turn to Plaintiffs’ remaining claim—invasion of privacy premised on the public disclosure of private facts.
D. Indiana recognizes a tort claim for the public disclosure of private facts, but the undisputed evidence negates the tort’s publicity element.
….
Community maintains it is entitled to summary judgment for two alternative reasons: (1) the disclosure tort does not exist in Indiana; and (2) assuming Indiana recognizes the tort, “the undisputed facts affirmatively negate” the publicity element. We address each argument in turn.
1. Indiana recognizes a tort claim for the public disclosure of private facts
Community asserts that the disclosure tort “is non-existent” in Indiana, while Plaintiffs call this characterization “inaccurate.” To be fair, their diverging views are understandable—but confusion surrounding the tort did not always exist. Today, we confirm the viability of a tort claim for the public disclosure of private facts in Indiana. This decision is guided by what led to its uncertainty and why its existence is so vital now.
….
We echo their concerns and join nearly every other state in explicitly recognizing an invasion-of-privacy tort claim based on the public disclosure of private facts.3 Recognition of this tort is especially important today, as private information is more easily accessed and disseminated— particularly in ways that can reach a large audience. In effect, the disclosure tort offers a meaningful way to deter unauthorized disclosures of private information. And when deterrence or other preventive measures fail, it can provide victims with meaningful redress.
We explicitly adopt the disclosure tort as it is articulated in the Restatement (Second) of Torts § 652D, which establishes four requirements: (1) the information disclosed must be private in nature; (2) the disclosure must be made to the public; (3) the disclosure must be one that would be highly offensive to a reasonable person; and (4) the information disclosed is not of legitimate public concern. We briefly detail the contours of each in turn.
….
With this framework in hand, we now determine whether Plaintiffs’ public-disclosure claim survives summary judgment.
2. Community is entitled to summary judgment on the public-disclosure claim because the undisputed facts negate the publicity element.
Community maintains that Plaintiffs’ public-disclosure claim must fail because “there was no publication as a matter of law.” On this record, we agree.
….
Because the publicity element fails as a matter of law, Community is entitled to summary judgment on the claim for respondeat superior liability premised on Gray’s alleged public disclosure of private facts.
Conclusion
We affirm the trial court’s denial of Community’s motion to dismiss for lack of subject-matter jurisdiction because Plaintiffs’ claims are not subject to Indiana’s Medical Malpractice Act. But we reverse the denial of Community’s motion for summary judgment because Community has affirmatively negated a required element on each of the claims against it. We thus remand to the trial court with instructions to enter judgment in favor of Community on all claims. [Footnote omitted.]
David, Massa, Slaughter, and Goff, JJ., concur